Google caught pilfering Kenyan business directory in sting operation

After getting some weird phone calls, a Kenyan business directory found that …

Google's "don't be evil" motto has already come under scrutiny once this week after the company was found to be profiting from advertisements placed by fraudulent retailers. The search company is under fire again, amid claims that it has been harvesting data from a Kenyan business directory, contacting the businesses, and telling them that the directory plans to charge them a listing fee, while also claiming to be working in partnership with the directory's operators.

Mocality Kenya operates the largest business directory in Kenya. The directory uses an innovative crowdsourced business model to ensure that its contents are comprehensive and accurate: any Kenyan with a mobile phone can submit entries to the database, and when these entries have been validated, rewards are paid using M-Pesa, a mobile payment system used in a number of developing nations.

Mocality lists businesses of all sizes, and for many companies in the directory, a listing on Mocality is their first or only Web presence. The company does not offer Web sites or Web hosting; just a listing of the business's particulars in a directory. Mocality also operates a call center that business owners can contact should they need assistance in updating their listings.

Mocality's business is its database. The data is all published on the Web, and looking up companies through the Web site is free and unrestricted, but the company guards against automated attempts to harvest the data.

In October last year, Mocality was surprised to start receiving calls from business owners wanting help with their websites. These were initially dismissed—Mocality doesn't offer websites—but the calls continued through November and into December.

This prompted the Mocality team to start doing some detective work. It analyzed the log files of its Web servers to see if there was any common link between the companies that had called asking for assistance with their websites. Indeed there was: the directory listings for those businesses had all been visited by users from a single IP address that belonged to a Kenyan WiMAX ISP.

All of the page requests from that IP had the same unusual Web browser user agent string, indicating the use of Google Chrome on Linux. The records also showed that the pages were accessed during regular working hours, which suggested that the organization behind the mystery IP address was using a team of humans to trawl through Mocality's database. This left the company wondering what they were doing, and why.

To find out, it decided to set up a sting operation. 10 percent of all requests from the IP address in question would show the wrong data—instead of getting the businesses' phone numbers, the people harvesting the data would be given Mocality's number.

The sting was in operation for just three hours. During that time, Mocality received seven calls. Each time the callers claimed to be working for Google Kenya, and that Google Kenya was working with Mocality on a project called Getting Kenyan Business Online.

Getting Kenyan Business Online is actually a legitimate part of Google's Getting Business Online effort. GKBO gives Kenyan businesses a free website and Web hosting, along with training on how to build an effective online presence. Over the past two years, the Getting Business Online initiative has connected to 400,000 companies across 20 different countries.

But Mocality is not part of the project, and has not partnered with Google to provide this data.

More troubling was that some of the calls Mocality received claimed that Mocality wanted to charge businesses Ksh20,000 (about $230) for being included in its directory, and further that GKBO charged the same amount for Web hosting. Neither of these things was true. Mocality's listings are all free, as is GKBO's hosting (with one exception; businesses using a custom domain name must pay a small fee).

Though the callers identified themselves as working for Google Kenya, this could have been a simple scam. After all, as all my fellow winners of the Microsoft lottery know, scammers are quite willing to exploit the names of respectable businesses.

But such doubts would shortly be laid to rest. The traffic from the Kenyan ISP stopped, only to be replaced by an identical pattern of traffic from 74.125.63.33—an IP address assigned directly to Google. Mocality repeated its sting operation and once again the calls started rolling in, with Google staff, this time from Google India, offering Web site services and claiming to be working in partnership with Mocality.

With the evidence collected, Mocality CEO Stefan Magdalinski went public, making a blog post, Google, what were you thinking?, detailing the company's findings, and asking the advertising giant three questions:

If Google wanted to work with our data, why didn't they just ask?

Who authorised this?

Who knew, and who SHOULD have known, even if they didn't know?

All fair questions. Pillaging Mocality's database (and violating the site's terms of use in the process), claiming to be working in partnership with Mocality, and trying to scare businesses with directory listings with stories of monthly fees all seem quite at odds with Google's Don't be evil motto.

Google says that Magdalinski's blog post was the first time it learned of the problem. Nelson Mattos, Google Vice-President for Product and Engineering, Europe and Emerging Markets, has issued a statement saying that "We were mortified to learn that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've already unreservedly apologized to Mocality."

That a team working for Google on the GKBO project was harvesting Mocality's data and lying to businesses is clear. How and why that happened remains uncertain. At the moment, Google is still uncertain as to who is responsible for what happened. Google Kenya has partnered with local firms as part of the GKBO program, and Google is not sure if it was Google Kenya or one of these partner organizations responsible for the abuse of Mocality's data, the dishonest claims to have a partnership, or the claims that Mocality wanted to charge companies to be featured in its directory.

The attempt to collect Ksh20,000/month for GKBO Web hosting adds another layer of intrigue; as well as trading off Mocality's good name to help recruit businesses to GKBO, it suggests that someone involved in the GKBO operation is attempting to pocket some cash for themselves by charging for something that should be free.

The action by the party or parties violated Google's business practices, and Google says that it was not sanctioned. The cold calling scripts that Google thought GKBO was using makes no mention of Mocality. The company promises that as soon as it has "all the facts" it will be "taking the appropriate action with the people involved."

104 Reader Comments

"We were mortified to learn that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've already unreservedly apologized to Mocality."

Sounds like a pretty big team if they had people in both Kenya and India.

Sounds like a pretty big team if they had people in both Kenya and India.

All you need is internet access and you can have a team of people spread out across multiple countries easily. Doesn't have to be terribly big. In fact, the smaller the team the longer you can get away with stuff like this before higher ups catch wind and can you.

I wouldn't blame Google per se. Rather, I'd blame the people who directed and carried out the acts.

You completely blame Google. These people represent the company and it's operations. Corporations need to be held accountable for the actions of their employees. Google takes the blame publicly and issues reprimands/firings internally. If this was Microsoft people would put all the blame on them but because it's Google it's ok?

The big problem I see here is that Google will probably not lose regardless of what happens. They've already made inroads using stolen data and that's probably all they needed.

If it was policy for that team, then I agree Google is to blame. It would be a serious management failure. If it was a small group that found a way to use the company to run their own scam? No, I'd blame the employees.

@bigmig it was outsourced to india, so it would have been an outside company at that point. this is horrible news either way, I hope google resolves it and makes a public report about it because this is absolutely uncalled for and insulting to mocality.

If it was policy for that team, then I agree Google is to blame. It would be a serious management failure. If it was a small group that found a way to use the company to run their own scam? No, I'd blame the employees.

I'm not a fan of Google, but every company has some bad apples.

It would have to be a pretty big group of people considering it started in Kenya and it was outsourced to India.

Every company may have bad apples but who gets the blame for the situations with Skyhook? Yelp? net neutrality? wifi snooping? Sooner or later Google is going to have to take the blame for these things and others have to stop pretending that they're the fun-loving company that does no evil.

I wouldn't blame Google per se. Rather, I'd blame the people who directed and carried out the acts.

Yeah, this reminds me of when people flip out about bad practices at Wal-Mart (forced overtime, hiring illegals, shitty women treatment). It's not corporate policy, it's just individual bad management.

SOMETIMES it's individual bad management, sometimes it's essentially sanctioned from the top, with a nod and a wink.I'm generally willing to cut Google some slack, but as incidents like this pile up, you start to wonder about the criteria they are using to hire people. Are they a little too interested in people who say "well I'd never actually break the law, but I'd do everything short of that to achieve an advantage"?

can somebody explain to me how a kid who made a website in the UK that does what google routinely does link to infringing content can be extradited to the usa. I like the usa but if this is what is happening now what is it going to be like under sopa. If google are found guilty they should definately be fined just because they have lawyers coming out of every corporate orifice does not make them immune to the law or it shouldn't.

I wouldn't blame Google per se. Rather, I'd blame the people who directed and carried out the acts.

Yeah, this reminds me of when people flip out about bad practices at Wal-Mart (forced overtime, hiring illegals, shitty women treatment). It's not corporate policy, it's just individual bad management.

Sorry. If you get the rock-star treatment for a successful company (I'm talking to you, CEOs, saviors of America), and not its hard-working employes; then you should get harsh treatment for a company that misbehaves, and not its shit employes. Anything else is just nauseatingly juvenile.

@bigmig it was outsourced to india, so it would have been an outside company at that point. this is horrible news either way, I hope google resolves it and makes a public report about it because this is absolutely uncalled for and insulting to mocality.

Did you read the article? The people in India were also Google employees. Not only was it inside the company, but it was inside the company at multiple locations. It clearly was not just one or two "bad apples."

"We were mortified to learn that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've already unreservedly apologized to Mocality."

More than tears are required to make amends in the business world. I hope a judge agrees.

I dont understand the problem. Yeah, Google should be held accountable for its employee's actions. However, they did what any respectable company would do when found in such (inevitable with a company that large) complications: apologized and is (claimed) investigating with punishment intended.

@bigmig it was outsourced to india, so it would have been an outside company at that point. this is horrible news either way, I hope google resolves it and makes a public report about it because this is absolutely uncalled for and insulting to mocality.

Did you read the article? The people in India were also Google employees. Not only was it inside the company, but it was inside the company at multiple locations.

Right on. The reasonable reaction to this discovery would not be to (as the person you reply to) assume extenuation but to assume Google is up to much more of this than we can know.

Google is a massive organisation, I highly doubt this was officially sanctioned at the level of management who would need to sanction something like this if they were actually aware of it, looks very much like a contracted partnet decided to scam some people thinking no-one would notice.

Google can demonstrate that it doesn't play this way by investigating and firing the guilty people. I doubt if the people in Mountain View knew what was going on in Kenya, but if no one's head rolls (and if the manager in charge of Getting Kenya Online still gets his/her bonus based on business falsely drummed up) then the word gets out that anything goes and "Don't be evil" is just a slogan.

Google is a massive organisation, I highly doubt this was officially sanctioned at the level of management who would need to sanction something like this if they were actually aware of it, looks very much like a contracted partnet decided to scam some people thinking no-one would notice.

Well, what level of management would need to sanction it if they were actually aware of it? And more to the point, if you hire contractors, how much free rein do you give them to affect your reputation? Do you just tell 'em to get the job done and wash your hands of it?

To me, this seems like a classic political "who knew what, and when did they know it?" scandal. The best possible outcome (for Google) is that contractors were hired with no oversight and nobody interested in the work they were doing; this is basic negligence. And that's the best case.

Think of it this way. you hire a company to build a fence in your yard. They decide it's cheaper / easier / whatever to tear down your neighbor's fence (or house) to build your fence. Would you say something if you noticed this? Or is the defense that you're an absentee landlord, not really responsible for what mere contractors do? Either way, it doesn't speak to great levels of responsibility.

Google is definitely to blame, since directly or indirectly they are responsible for everyone and every company they chose to hire or partner with. Just because they're a large company that doesn't absolve them of their responsibility when someone else acts in an unethical or illegal manner while conducting official business for Google.

A lot of companies will include a clause in outsourcing contracts naming the hired company responsible for any monetary damages they cause. If that's not possible then they'll use a different clause that withholds compensation or penalizes the hired company in some other way if it causes damage to the hiring company. This does little to protect the consumer or other businesses, but it goes a long way towards indicating how much risk the hiring company knows it's taking on by outsourcing, yet it still takes on that risk because of the financial advantage it hopes to gain. The hiring company might be able to protect itself financially, but ethically both parties share responsibility for any actions the hired company takes.

The idea that management can't control everything is a bad excuse. Management, by definition, is responsible for managing their employees and business relationships. They need to make better decisions about who they hire and who they work with.

I did a breif stint of buisness-to-buisness cold-calling a few years back. We were required to lie as a routine part of the job. First day I was handed a phone and a phone number and told to get certain information however I could. The manager gave me some example-lies which might get me the info. The manager watched me call and lie to get the info, and then said "good job, keep it up, todays quota is one hundred sucessful calls just like that". All this left me with the impression that this kind of thing was more-or-lesss standard-practice among the companies contracted to do this kind of work. I actually felt pretty bad about all this at the time, and would not do it again.

Assigning blame is of little interest to me, google employees got caught doing what they shouldn't, apologies and firing whoever is ultimately held responsible is just normal when that happens. However will google do anything to actually try and set things right with Mocality ?

Working in third-world countries is difificult. I come from one. You must be really careful with who you hire. And even then, these things can happen. I think this is a case of rogue employees taking advantage at their position in Google to steal money for their own personal profit. It doesn't seem to me that Google is at fault, as a company, as the article so prominently suggests. The facts don't hold up to that.

...You completely blame Google. These people represent the company and it's operations. Corporations need to be held accountable for the actions of their employees. Google takes the blame publicly and issues reprimands/firings internally. If this was Microsoft people would put all the blame on them but because it's Google it's ok?The big problem I see here is that Google will probably not lose regardless of what happens. They've already made inroads using stolen data and that's probably all they needed.

...Which is another thing that needs to happen. Google needs to delete all copies of Mocality data in their possession, and use their search-engine special-powers to root out anyone who tries to retain any of those ill-gotten gains.LESSON FOR BUSINESS LEADERS: Don't just ask what's wrong, when your staff are "under-performing". When your staff are performing surprisingly well, you should also be asking them HOW they are doing it... Spend time on walk-about, insist on direct and unexpected contact with grass-roots, front-line staff... And see if the middle managers cringe...

"We were mortified to learn that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've already unreservedly apologized to Mocality."

"taking the appropriate action with the people involved."

Internal version:

"We were mortified to learn that someone outside of Google found out that a team of people working on a Google project improperly used Mocality's data and misrepresented our relationship with Mocality to encourage customers to create new websites. We've had to unreservedly apologized to Mocality and will be taking the appropriate action with the people involved to ensure these slip-ups don't happen in the future."

Well in some developing nations, employees do run scams using the institutions they work for and not just private businesses but even Government Employees do the same!

Actually you just have to look at the US Government and the Copyright industry.The employees namely the people's representatives are being bought out by the movie industry to do their dirty work for them and even trying to make it into suppressive laws like SOPA.

Point is, Google will do something about this scam happening on their turf, while i dont know if the US Gov will fight back against SOPA.